我尝试用sc delete <服务名>删除一个Windows服务,并遇到以下错误:

[SC] DeleteService FAILED 1072: 指定的服务已标记为删除。

我已经做了:

Stopped the service, obviously. The sc queryex "<service name>" gives the following result: SERVICE_NAME: Stub service TYPE : 10 WIN32_OWN_PROCESS STATE : 1 STOPPED WIN32_EXIT_CODE : 1067 (0x42b) SERVICE_EXIT_CODE : 0 (0x0) CHECKPOINT : 0x0 WAIT_HINT : 0x0 PID : 0 FLAGS : Ensured that Microsoft Management Console is closed (taskkill /F /IM mmc.exe), Ensured that Event Viewer is closed, Removed the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<service name> from the registry. Due to this removal, services.msc still shows the service (with a name, but no status or startup type), but the description is “<Failed to Read Description. Error Code: 2 >”. When attempting to view the properties, “The system cannot find the file specified.” is shown five times.

问题依然存在。

下一步是什么?


当前回答

在我的情况下,这是由创建eventLog源时未处理的异常引起的。使用try catch来确定原因。

其他回答

最有可能的是,删除服务失败是因为

protected override void OnStop()

停止服务时抛出错误。将内容包装在try catch中可以防止标记删除错误

protected override void OnStop()
{
            try
            {
                //things to do
            }
            catch (Exception)
            {
            }

}

似乎在Windows 7之后的Windows版本上(未经验证,但根据最新的Windows Server 2012 R2经验),服务控制管理器(SCM)更加严格。

而在Windows 7上,它只是生成另一个进程,它现在正在检查服务进程是否仍然存在,并且可能为任何后续调用CreateService/ deleeservice返回ERROR_SERVICE_MARKED_FOR_DELETE(1072),即使服务似乎已经停止。

我在这里谈论的是Windows API代码,但我想清楚地概述发生了什么,所以这个序列可能会导致上述错误:

SC_HANDLE hScm = OpenSCManager(nullptr, nullptr, SC_MANAGER_ALL_ACCESS);

SC_HANDLE hSvc = OpenService(hScm, L"Stub service", SERVICE_STOP | SERVICE_QUERY_STATUS | DELETE);

SERVICE_STATUS ss;
ControlService(hSvc, SERVICE_CONTROL_STOP, &ss);
// ... wait for service to report its SERVICE_STOPPED state

DeleteService(hSvc);
CloseServiceHandle(hSvc);
hSvc = nullptr;

// any further calls to CreateService/DeleteService will fail
// if service process is still around

服务进程在报告SERVICE_STOPPED状态后仍然存在的原因并不令人惊讶。这是一个常规进程,其主线程在对StartServiceCtrlDispatcher API的调用中被“卡住”,因此它首先对停止控制动作做出反应,但随后必须执行剩余的代码序列。

不幸的是,SCM/OS没有正确地为我们处理这个问题。 编程解决方案比较简单和准确:在停止服务之前获取服务可执行文件的进程句柄,然后等待这个句柄变成有信号的。

如果从系统管理的角度来处理这个问题,那么解决方案也是等待服务流程完全消失。

可能有几种原因导致服务卡在“标记为删除”中。

SysInternals' Process Explorer is opened. Closing it should lead to automatic removal of the service. Task Manager is opened. Microsoft Management Console (MMC) is opened. To ensure all instances are closed, run taskkill /F /IM mmc.exe. Services console is opened. This is the same as the previous point, since Services console is hosted by MMC. Event Viewer is opened. Again, this is the same as the third point. The key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{service name} exists. Someone else is logged into the server and has one of the previously mentioned applications opened. An instance of Visual Studio used to debug the service is open.

当我使用应用程序验证器验证我的win服务时,我遇到了这个问题。即使在我关闭App Ver后,我的服务也被阻止删除。只有从App Ver中删除服务才能解决这个问题,并且服务被立即删除。看起来有些进程还在使用你的服务在你试图删除一个之后。

有时,在通过PowerShell远程会话脚本删除服务时可能会发生这种情况,特别是当您试图多次删除服务时。在这种情况下,尝试在删除之前重新创建会话:

Remove-PSSession -Session $session
$newSession = New-PSSession -ComputerName $Name  -Credential $creds -ErrorAction Stop
Enter-PSSession $newSession